checkId: check.observability.logging plugin: stellaops.doctor.observability severity: warn tags: [observability, logging, structured-logs]

Logging Configuration

What It Checks

Reads default and framework log levels and looks for structured logging via Logging:Structured, JSON console formatting, or a Serilog configuration section. This check validates local log shape only; log-forwarder drain and backend delivery are verified by check.observability.logs.shipping.

The check warns when default logging is Debug or Trace, when Microsoft categories are too verbose, or when structured logging is missing.

Why It Matters

Unstructured logs slow incident response and make exports difficult to analyze. Overly verbose framework logging also drives storage growth and noise.

Common Causes

• Only the default ASP.NET console logger is configured
• Logging:Structured or Serilog settings were omitted from compose values
• Troubleshooting log levels were left enabled in production

How to Fix

Docker Compose

services:
  doctor-web:
    environment:
      Logging__LogLevel__Default: Information
      Logging__LogLevel__Microsoft: Warning
      Logging__Structured: "true"

If Serilog is used, make sure the console sink emits JSON or another structured format that downstream tooling can parse.

Bare Metal / systemd

Keep framework namespaces at Warning or stricter unless you are collecting short-lived debugging evidence.

Kubernetes / Helm

Ensure log collectors expect the same output format the application emits.

Verification

stella doctor run --check check.observability.logging

Related Checks

• check.observability.alerting - alerting often relies on structured log pipelines
• check.security.audit.logging - audit logs should follow the same transport and retention standards
• check.observability.logs.shipping - verifies configured log forwarders are alive and draining